CVE-2026-75005

HighCVSS 7.5/10Last modified Aug 28, 2026

Description

Inefficient Algorithmic Complexity vulnerability in Apache APISIX.

A single small request can pin a gateway worker at 100% CPU for an extended period in graphql-limit-count routes.

This issue affects Apache APISIX: 3.17.0.

Users are recommended to upgrade to version 3.18.0, which fixes the issue.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-407

Affected software

VendorProductVersions
Apache Software FoundationApache APISIX3.17.0

References

Timeline

Published
Aug 27, 2026
Last modified
Aug 28, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-750065.8In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, insufficient Cascading Style Sheets (CSS) sanitization in HTML e-mail messages maCVE-2026-750078.8In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, the LDAP search filter was subject to injection via unescaped %u/%fu/%d substitutCVE-2026-75013.5A weakness has been identified in LinkStackOrg LinkStack up to 4.8.6. Impacted is the function editPage of the file app/Http/Controllers/UseCVE-2026-750104.3In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, the modoboa driver of the password plugin could leak a Modoboa API authenticationCVE-2026-750116.3A flaw has been found in kylecui NetForensicMCP 2.1.0. Impacted is the function execAsync of the file index.js. Executing a manipulation of CVE-2026-750126.5A security vulnerability has been detected in TOTOLINK EX1200L 9.3.5u.6146_B20201023. Affected by this issue is the function setPasswordCfg CVE-2026-750136.5A vulnerability was detected in TOTOLINK EX1200L 9.3.5u.6146_B20201023. This affects the function setWizardCfg of the file /cgi-bin/cstecgi.CVE-2026-750147.3A flaw has been found in SourceCodester Pet Grooming Management Software 1.0. This vulnerability affects unknown code of the file /admin/getCVE-2026-750154.9Insufficiently Protected Credentials vulnerability in Apache Syncope. Audit events, when sent to the configured store, are not sufficientlyCVE-2026-750166.4The Magazine Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the News Ticker block's clientId attribute in versCVE-2026-750174.3The Magazine Blocks – Blog Designer, Magazine & Newspaper Website Builder, Page Builder with Posts Blocks, Post Grid plugin for WordPress isCVE-2026-750184.3The Custom Contact Forms plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 7.16. This is due
CVE-2026-75005: High severity, CVSS 7.5 | Vulnix